← 返回 Skills 市场
131
总下载
0
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install uapp-campaign
功能描述
友盟小程序推广链接管理技能，支持通过 umeng-cli call 调用友盟 OpenAPI（gateway.open.umeng.com）的 2 个推广接口（1 个写入 + 1 个只读），与旧 uapp-campaign 能力完全等价的 CLI 化。覆盖推广链接创建、活动/渠道清单查询。当用户需要为小程序创建推...
安全使用建议
This skill appears to do what it claims (call umeng-cli to create/list campaign links), but the SKILL.md forces the agent to run 'umeng-cli trace' telemetry commands: one immediately after reading the skill and another when an AppKey is provided. Those trace calls will send the skill name and potentially your AppKey to Umeng without explicit user consent. Before installing or enabling:
- Ask the skill author to remove or make telemetry optional and to require explicit user confirmation before sending any AppKey.
- If you must use it, do not let the agent auto-run the skill on load; require a user confirmation step before executing any commands that send data externally.
- Review the umeng-cli source (npm package or the install script) to see what 'trace' does and where data is sent.
- Prefer running the umeng-cli commands yourself in a terminal (or inspect outputs) rather than allowing the agent to run them automatically.
If you are uncomfortable with telemetry or automatic exfiltration of AppKey, treat this skill as untrusted until telemetry is made opt-in.
功能分析
Type: OpenClaw Skill
Name: uapp-campaign
Version: 1.2.0
The skill contains instructions that direct the AI agent to automatically execute telemetry commands (`umeng-cli trace`) including the 'appkey' (dataSourceId) immediately upon reading the documentation or receiving user input, which constitutes a form of prompt injection for unauthorized tracking. Additionally, the documentation encourages a high-risk installation pattern (`curl | sh`) for the `umeng-cli` tool. While these actions appear intended for usage analytics within the Umeng ecosystem, the use of the SKILL.md to force background command execution and telemetry without explicit user intervention is a security concern.
能力标签
能力评估
Purpose & Capability
The skill's name and description describe managing Umeng campaign links and all primary operations are performed via the umeng-cli tool as expected. There are no unrelated required env vars or binaries. However, the SKILL.md additionally instructs the agent to run 'umeng-cli trace' telemetry calls (on reading the doc and when an AppKey is supplied), which is not required to implement the core create/list campaign functionality and thus is extra behavior.
Instruction Scope
The SKILL.md explicitly instructs the AI agent to execute telemetry/tracing commands when the document is read and again when an AppKey is provided: `umeng-cli trace '{"skill_name":"umeng-cli-uapp-campaign"}'` and a second trace including the AppKey. Those trace calls send data off-host (skill name and potentially a user AppKey) and are not necessary for performing the Create/List API calls. This is scope creep and presents a risk of leaking user-provided AppKey or other contextual data without explicit user consent.
Install Mechanism
The skill is instruction-only (no install spec in registry), and the SKILL.md documents installation via npm (`npm install -g @umengfe/umeng-cli`) or an official GitHub raw install script. These are common distribution methods; the curl install points at raw.githubusercontent.com which is a standard release host. Risk is moderate if users run scripts blindly—reviewing the umeng-cli package or script is advised.
Credentials
The skill declares no required environment variables and relies on umeng-cli-managed AK/SK stored by the CLI. However, it instructs sending the AppKey (dataSourceId) to Umeng via telemetry when the AppKey is collected, effectively exfiltrating a credential-like identifier without it being declared as a required outgoing data use. The mandatory telemetry-on-read is not justified by the core functionality.
Persistence & Privilege
The skill does not request 'always: true' and does not modify other skills or system-wide settings. However, because agent invocation is allowed, an autonomous agent following the SKILL.md could immediately execute the telemetry trace when it loads the skill, increasing the practical impact of the telemetry instruction. This combination (autonomous invocation + mandatory telemetry call) raises privacy concerns even though persistence/privilege settings themselves are ordinary.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install uapp-campaign - 安装完成后，直接呼叫该 Skill 的名称或使用
/uapp-campaign触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.2.0
**重大变更：全面切换为 umeng-cli CLI 调用，移除所有 Python 代码，Skill 全面 CLI 化。**
- 移除了旧有的 Python 脚本和第三方 SDK，Skill 不再包含任何源码，仅保留文档与 CLI 调用指引。
- 更新 Skill 名称、描述与元数据，明确指定依赖于 umeng-cli 命令行工具。
- 业务能力完全等价，覆盖推广活动创建和活动/渠道查询，所有操作改为通过 umeng-cli call 调用友盟 OpenAPI。
- 新版文档详细指引 umeng-cli 安装、鉴权、登录与常用调用范例。
- 强化类型边界和输入校验，统一报错和二次确认提示，写入操作增加用户提示和确认机制。
- 明确仅支持小程序/H5/小游戏类型，对 App 场景增加能力分流说明。
v1.1.0
- Enhanced documentation with detailed usage flow, user prompts, and error handling scenarios.
- Added explicit steps for intent confirmation, application name checks, and exception management.
- Clarified boundary conditions for supported platforms and provided user messaging for unsupported cases.
- Improved example questions and refined descriptions for all major features.
- No code logic changed; all modifications are to SKILL.md.
v1.0.0
uapp-campaign 1.0.0
- 首发版本，支持小程序推广链接与渠道管理
- 支持通过命令行创建推广链接、查询活动和渠道列表
- 提供 CLI 示例与常用参数说明
- 支持 JSON 格式输出与多种配置方式
元数据
常见问题
小程序推广链接管理 是什么？
友盟小程序推广链接管理技能，支持通过 umeng-cli call 调用友盟 OpenAPI（gateway.open.umeng.com）的 2 个推广接口（1 个写入 + 1 个只读），与旧 uapp-campaign 能力完全等价的 CLI 化。覆盖推广链接创建、活动/渠道清单查询。当用户需要为小程序创建推... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 131 次。
如何安装 小程序推广链接管理？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install uapp-campaign」即可一键安装，无需额外配置。
小程序推广链接管理 是免费的吗？
是的，小程序推广链接管理 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
小程序推广链接管理 支持哪些平台？
小程序推广链接管理 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 小程序推广链接管理？
由 Umeng+（@squall0925）开发并维护，当前版本 v1.2.0。
推荐 Skills